Hackers Steal Personal Data and Driving Licence Details of Thousands of Uber Drivers

Thousands of drivers working for ride-sharing giant Uber have had their personal information and driving licence details compromised in a cyberattack. Uber has confirmed that the data theft occurred during an attack on one of its third-party technology service providers last October.

Uber confirmed the incident in documents filed this week with the offices of attorneys general in several US states, including California. According to the filings, the technology company notified Uber on October 9 that hackers had infiltrated its internal systems, stolen confidential access credentials and used them to access information stored by Uber. The company has since begun notifying affected drivers.

According to technology news outlet TechCrunch, the service provider involved in the data breach is Fireworks AI. The company primarily enables developers to use open-source artificial intelligence models.

Last month, Fireworks AI disclosed that hackers had stolen some personal AI datasets belonging to its customers, along with billing information. The same attack was also reported to have compromised data belonging to popular online platform Nation.

An Uber spokesperson told TechCrunch that a security vulnerability at its third-party vendor, Fireworks AI, had resulted in unauthorised access to some Uber data. The company is therefore sending security notifications to affected drivers.

However, Uber has not disclosed the exact number of customers or drivers affected by the incident. Fireworks AI has not provided any comment on the matter.

An analysis of the relevant documents revealed that the stolen information included driving licence details belonging to 2,567 residents of Massachusetts, 3,430 residents of South Carolina and 1,873 residents of Rhode Island.

Drivers in Illinois and California were also affected by the data theft, although the exact number of victims in those states has not yet been determined. As the investigation remains ongoing, the number of affected drivers is expected to increase.

Fireworks AI said the attack was carried out by a financially motivated cybercriminal group whose primary objective was to steal and sell access tokens for large language models. However, no hacker group has claimed responsibility for the attack so far.

Notably, this is Uber's second major data breach this year. The company's freight transportation division, Uber Freight, was also targeted in a cyberattack earlier this year.

//DBTech/BMT/OR//